The Tea on Cybersecurity

Most companies continually push code, launch new features, and update their infrastructure. However, for many businesses, security testing occurs only once a year. That gap leaves systems exposed to risks that go unnoticed.

In this episode, Anh Pham, Director of Penetration Testing at Trava, explains the concept of Penetration Testing as a Service (PTaaS). He shares how it works and why it's more beneficial than one-time pentests. You’ll also learn how AI fits into the picture and what to consider when choosing a provider.

Key takeaways:

• The difference between PTaaS and traditional pentesting
• How PTaaS supports fast-changing environments
• The qualities of a trustworthy PTaaS provider 

PTaaS is just one part of a bigger security picture. Learn how Continuous Threat Exposure Management (CTEM) helps you stay ahead of risks in our blog: What Is CTEM and Why It Matters for Modern Security Programs: https://travasecurity.com/ctem-explained

Episode highlights:

(00:00) Today’s topic: Penetration Testing as a Service

(03:16) PTaaS vs one-time pentests

(08:36) How PTaaS works

(11:59) Choosing a secure PTaaS provider

(13:17) Can AI help in PTaaS?

(15:22) A key reminder for businesses getting started

Connect with the host:

Jara Rowe’s LinkedIn - @jararowe

Connect with the guest:

Anh Pham’s LinkedIn - @anhpham11

Connect with Trava:

Website - www.travasecurity.com

Blog - www.travasecurity.com/learn-with-trava/blog

LinkedIn - @travasecurity

YouTube - @travasecurity

Listen to past episodes:

Unveiling Vulnerabilities: The Power of Pen Testing - https://travasecurity.com/learn-with-trava/podcasts/unveiling-vulnerabilities-the-power-of-pen-testing-in-cybersecurity/

Proving Compliance and Security Effectiveness Through Pen Testing - https://travasecurity.com/learn-with-trava/podcasts/proving-compliance-and-security-effectiveness-through-pen-testing/

Cyber engineering is a broad and often misunderstood field, covering everything from cloud architecture to compliance. But one thing is clear: someone needs to take responsibility for the security of your business’s digital infrastructure.

In this episode, host Jara Rowe is joined by Michael Magyar, vCISO at Trava Security, to explore the intersection of cybersecurity, compliance, and engineering. Michael shares what smart architecture looks like in practice, where organizations often fall short, and how emerging trends like AI impact cyber engineering.

Key takeaways:

• How smart cyber engineering impacts security and operations
• The influence of AI on cyber engineering tasks
• When to seek outside help for technical implementation

If you’re curious about the top risks companies face in cloud and SaaS environments—and how to address them—check out our blog: Seven Security Issues in SaaS and Cloud Computing: https://travasecurity.com/saas-security-issues

Episode highlights:

(00:00) Today’s topic: Cyber engineering

(05:29) The push for more security and compliance

(07:44) Being intentional with security architecture

(10:33) Cybersecurity engineering in the real world

(13:52) Cyber engineering trends and AI 

(19:37) Discerning when to hire outside experts

Connect with the host:

Jara Rowe’s LinkedIn - @jararowe

Connect with the guest:

Michael Magyar’s LinkedIn - @michael-magyar-cyqual

Connect with Trava:

Website - www.travasecurity.com

Blog - www.travasecurity.com/learn-with-trava/blog

LinkedIn - @travasecurity

YouTube - @travasecurity

The rapid adoption of AI brings opportunities, yet new risks. Strong governance enables organizations to remain innovative while maintaining trust and protecting data.

In this episode, host Jara Rowe welcomes Jim Goldman, Co-Founder of Trava Security, to discuss how clear oversight, board engagement, and high-quality data enable the creation of ethical AI that aligns with business goals.

They outline practical steps, common blind spots, and proven frameworks for trustworthy automation.

Key takeaways:

• AI governance versus compliance in plain language
• Why data quality shapes reliable machine output
• How leaders and teams share accountability from policy to practice

Continue your learning with our blog post, "How SaaS Companies Can Navigate AI Compliance Challenges," for best practices and framework details: https://travasecurity.com/navigating-ai-compliance

Episode highlights:

(00:00) Today’s topic: AI Governance

(02:46) Governance reaches the boardroom

(04:09) Big shifts in NIST CSF 2.0

(06:01) Governance versus compliance explained

(07:45) Data quality risks in AI

(10:55) Core parts of a governance framework

(13:32) Roles and ownership across teams

(14:55) Designing ethical, transparent AI

(19:06) Proving accountability in decisions

(23:37) Easing public worries with openness

(26:41) Criminal abuse and law response

Connect with the host:

Jara Rowe’s LinkedIn - @jararowe

Connect with the guest:

Jim Goldman’s LinkedIn - @jigoldman

Connect with Trava:

Website - www.travasecurity.com

Blog - www.travasecurity.com/learn-with-trava/blog

LinkedIn - @travasecurity

YouTube - @travasecurity

Businesses rely on AI for everything from streamlining communication to managing hiring and forecasting trends. It’s fast, efficient, and deeply embedded in daily operations. But as AI becomes more common, one critical piece is often overlooked: compliance.

In this episode, Jara Rowe sits down with Dr. Marwan Omar, Chief AI Officer at Insight Assurance, to talk about the growing need for AI compliance. They explore what it really means, why it’s not just a concern for tech giants, and how overlooking it could expose your business to legal, ethical, and reputational risks.

Key takeaways:

• What makes AI compliance different from traditional IT compliance
• Where to start with AI risk assessments
• How real companies have gotten AI compliance wrong

You heard Marwan discuss the critical need to address AI bias, transparency, and regulation (like the EU AI Act). Don't just audit—mitigate the risk! Explore Trava's AI Risk Management Services to ensure your systems are ethical, secure, and compliant with key frameworks like NIST AI RMF and ISO 42001: https://travasecurity.com/ai-risk-services

Episode highlights:

(00:00) Today’s topic: AI compliance and why it matters 

(05:23) Key laws shaping AI compliance today

(07:25) The nuances of AI compliance

(10:14) First steps to build AI compliance internally

(13:26) How explainability strengthens trust in AI models

(15:32) Challenges with regulations and data privacy

(18:24) Staying informed as AI laws evolve

Connect with the host:

Jara Rowe’s LinkedIn - @jararowe

Connect with the guest:

Marwan Omar’s LinkedIn - @dr-marwan-omar

Connect with Trava:

Website - www.travasecurity.com

Blog - www.travasecurity.com/learn-with-trava/blog

LinkedIn - @travasecurity

YouTube - @travasecurity

Many companies start penetration testing to address compliance requirements. However, it can also provide valuable insights beyond just meeting standards.

In this episode, host Jara Rowe sits down with Anh Pham and Christina Annechino from Trava to talk about how pen tests uncover hidden risks and strengthen your cybersecurity. They explain compliance frameworks, typical pen test schedules, and common mistakes to avoid.

Key takeaways:

• Compliance frameworks and their pen test requirements
• The different types of penetration testing
• How to prepare your environment for a successful pen test

The podcast broke down Pen Tests and Vulnerability Scans. Now, read "What Are the Different Types of Cybersecurity Assessments?" to understand where each security check fits in your overall risk program: https://travasecurity.com/cyber-assessments

Episode highlights:

(00:00) Today’s topic: Penetration Testing and Compliance

(03:42) Pen testing compliance frameworks

(05:46) The difference between vulnerability scans and pen tests

(09:11) How often to conduct pen tests

(11:04) Qualities of a good penetration testing vendor 

(14:34) Making pen testing work on a budget

(16:49) Scoping mistakes that limit test outcomes

(18:53) Using pen tests to improve overall cybersecurity

Connect with the host:

Jara Rowe’s LinkedIn - @jararowe

Connect with the guest:

Anh Pham’s LinkedIn - @anhpham11

Christina Annechino’s LinkedIn - @christinaannechino

Connect with Trava:

Website - www.travasecurity.com

Blog - www.travasecurity.com/learn-with-trava/blog

LinkedIn - @travasecurity

YouTube - @travasecurity

Listen to a related episode:

Unveiling Vulnerabilities: The Power of Pen Testing - https://travasecurity.com/learn-with-trava/podcasts/unveiling-vulnerabilities-the-power-of-pen-testing-in-cybersecurity/

Think compliance is just an IT problem? It’s a revenue problem, too. Without it, some contracts will stay out of reach.

In this episode, Jara Rowe talks with Tom Greco, vCISO at Trava Security, about what companies need to know about the Cybersecurity Maturity Model Certification (CMMC). It’s a Department of Defense requirement that verifies whether companies are securely handling Controlled Unclassified Information (CUI). Tom Greco explains what CMMC involves, how scoping affects your readiness, and how to maintain compliance over time. In short, if you want to win or keep federal contracts, CMMC compliance isn’t optional.

Key takeaways:

• What CMMC is and why it exists
• The importance of accurate scoping
• Tools and tips to maintain CMMC compliance

You don't have to be. We covered the essentials, but to get a clear, concise breakdown of the entire framework, read our easy-to-understand guide: "What Is CMMC in a Nutshell?" Click to gain clarity on the CMMC levels and start securing your DoD contracts today: https://travasecurity.com/cmmc-nutshell

Episode highlights:

(00:00) Today’s topic: What is CMMC?

(02:20) What CMMC means for your business

(06:05) The nuances of scoping

(10:07) How contracts set your CMMC level 

(13:44) Self-assessment vs third-party audits

(17:36) Maintaining CMMC compliance over time

(22:17) Perform gap assessments ASAP

Connect with the host:

Jara Rowe’s LinkedIn - @jararowe

Connect with the guest:

Thomas Greco’s LinkedIn - @thomas-greco

Connect with Trava:

Website - www.travasecurity.com

Blog - www.travasecurity.com/learn-with-trava/blog

LinkedIn - @travasecurity

YouTube - @travasecurity

Is your business one cyberattack away from chaos? Most companies don’t think about cybersecurity until they’re in crisis mode—but by then, the damage is done.

In this episode, Jara Rowe talks with Michael Magyar, an experienced virtual Chief Information Security Officer (vCISO). They cover what a vCISO does, why more companies are choosing virtual over full-time, and how to know when it’s time to bring one in. Michael shares examples of helping businesses avoid costly mistakes, explains how vCISOs assess risk, and offers advice for small teams trying to do more with less.

Key takeaways:

• Common cybersecurity challenges vCISOs help solve
• What a typical engagement with a vCISO looks like
• Advice for SMBs with limited budgets trying to prioritize cybersecurity

You know what a vCISO is and the value they bring. The next step is finding the perfect fit for your business. Download Trava's comprehensive guide, "Steps to Selecting Your vCISO Partner," for expert insights, actionable tips, and a clear roadmap for choosing the right executive-level security expertise: https://travasecurity.com/selecting-vciso

Episode highlights:

(00:00) Today’s topic: Breaking down the role of a vCISO

(05:32) vCISO vs. traditional in-house CISO

(07:11) Why small businesses benefit from a vCISO

(09:53) Real examples of vCISOs making a difference

(13:52) What it’s like working with a vCISO

(16:00) Key indicators your business needs a vCISO

(20:54) How to prioritize cybersecurity on a budget

Connect with the host:

Jara Rowe’s LinkedIn - @jararowe

Connect with the guest:

Michael Magyar’s LinkedIn - @michael-magyar-cyqual

Connect with Trava:

Website - www.travasecurity.com

Blog - www.travasecurity.com/learn-with-trava/blog

LinkedIn - @travasecurity

YouTube - @travasecurity

Cybersecurity lingo can be overwhelming, but once you get the hang of the essentials, staying secure becomes much easier.

In this episode, host Jara Rowe sits down with Marie Joseph, Senior Security Advisor at Trava, to break down key terms like vCISO, PII, and cybersecurity maturity models. They also differentiate between terms like hacker vs. threat actor and firewall vs. antivirus by highlighting the nuances that matter most. Plus, Marie reveals why continuous compliance is crucial, and how concepts like attack surface and risk tolerance fit into the bigger picture of your security strategy.

Key takeaways:

• Essential cybersecurity terms and definitions: vCISO, PII, and more  
• The importance of understanding and managing your attack surface
• Why cybersecurity compliance can’t be a one-time effort

Want to learn more jargon? Download the essential resource to understand the language of compliance: Conquer Compliance Jargon: Download the Free Cybersecurity Compliance Glossary: https://travasecurity.com/conquer-jargon

Episode highlights:

(00:00) Today’s topic: Understanding cybersecurity terms

(01:47) What is a vCISO, and why it benefits small businesses

(02:54) Definition of PII, BCP, SIEM, DevSecOps, and BCRA 

(08:40) Hackers vs. threat actors Explained

(10:28) Why businesses need an antivirus and a firewall

(13:37) Patch management and cybersecurity attack surfaces

(16:04) Continuous cybersecurity compliance

(21:27) Recapping cybersecurity essentials

Connect with the host:

Jara Rowe’s LinkedIn - @jararowe

Connect with the guest:

Marie Joseph’s LinkedIn - @marie-joseph-a81394143

Connect with Trava:

Website - www.travasecurity.com

Blog - www.travasecurity.com/learn-with-trava/blog

LinkedIn - @travasecurity

YouTube - @travasecurity

Cyber threats are evolving, security rules are tightening, and the idea of a ‘safe network’ is quickly disappearing. So what does that mean for businesses and individuals trying to stay protected?

To kick off Season 4, host Jara Rowe revisits key lessons from past seasons and unpacks the biggest cybersecurity trends shaping the industry today. This season will take a deeper look at AI governance, compliance challenges, and penetration testing—critical areas companies can’t afford to ignore.

With cybersecurity changing fast, businesses must decide how to adapt before they fall behind. The answers start here.

Key takeaways:

• Why cybersecurity is a team effort, not just IT’s job
• How AI is changing both cyber defense and cybercrime
• How vCISOs are filling critical security gaps for businesses

Episode highlights:

(00:00) Today’s topic: How cybersecurity is evolving

(01:21) Major lessons from past seasons

(05:38) Current cybersecurity trends

(08:26) What to expect in season 4

Connect with the host:

Jara Rowe’s LinkedIn - @jararowe

Connect with Trava:

Website - www.travasecurity.com

Blog - www.travasecurity.com/learn-with-trava/blog/

LinkedIn - @travasecurity

YouTube - @travasecurity

We’ve come to the end of another Season of The Tea on Cybersecurity and you know what that means. Join host Jara Rowe in her ultimate receipts from season 3. She highlights the most important things she has learned from her guests this season including why MFA is key to keeping yourself safe online, how to manage vulnerabilities, what steps you need in preparing for cybersecurity incidents, and how to cultivate trust and transparency within your organizations.

Listen in as Jara revisits her conversations with all of our Season 3 guests including Trava CEO Jim Goldman, Craig Saldanha and Mario Vlieg with Insight Insurance, and John Boomershine with BlankInkIT, among others. 

In this episode, you’ll learn:

• Multi-Factor Authentication (MFA) is Your Best Friend: It's like adding an extra lock to your door to keep the bad guys out—and who doesn’t want that extra peace of mind? Enabling MFA can be a game-changer in protecting against cyber vulnerabilities. It's easy to implement and adds that essential layer of security without the hassle!
• Bring Your Own Device (BYOD) Take Control of Your Digital Inventory: This is a deep dive on how to make sure all devices, company-owned or personal, are secure and compliant in this digitally diverse world. This is super relevant for those offering flexible work arrangements and want to stay ahead in your cybersecurity game.
• Establishing Trust and Transparency is Key: This isn’t just about securing your systems but also about earning and maintaining the trust of your customers and stakeholders— whether it’s securing communications through encryption or ensuring third-party vendors are just as vigilant. 

Visit the Trava website to find actionable guides, compliance solutions, and the tools you need to master MFA, asset control, and continuous vulnerability management: https://travasecurity.com/learn Jump into the conversation:

[00:00 - 00:41] Introduction to the Tea on Cybersecurity podcast

[00:41 - 3:46] The importance of MFA

[03:47 - 05:07] MFA in cyber hygiene

[05:08 - 06:02] Employee training as a vital part of cybersecurity defense strategy

[06:52 - 07:45] BOYD (bring your own device) and the challenges of inventory management

[07:45 - 10:07] A different way to think about risk

[10:08 - 12:12] The difference between risks and vulnerabilities

[12:18 - 13:24] The difference between breaches and incidents

[13:25 - 14:15] What to do if an incident should occur

[14:19 - 16:17] Steps to take if an incident were to occur with a third-party vendor

[16:18 - 17:58] Why trust is foundational to cybersecurity

[17:59 - 19:03] How a compliance framework is like a cookbook

[19:03 - 21:21] Cybersecurity in healthcare and banking

Connect with the host:

Jara Rowe’s LinkedIn

Connect with Trava:

Website www.travasecurity.com

Blog www.travasecurity.com/blog

LinkedIn @travasecurity

YouTube @travasecurity